A Practical Guide to Adding Enterprise SSO and SCIM to Better Auth Apps

Better Auth gives developers simple login and session management, but once your customer base grows to mid-size and large enterprises, SAML, OIDC single sign-on, and SCIM directory sync quickly become must-haves. How can you add these enterprise capabilities while keeping your existing auth architecture? One proven path is: keep using Better Auth for regular login and sessions, and let WorkOS handle enterprise SSO and directory sync. This article builds on that idea and breaks down the architectural tradeoffs and implementation details behind the integration.

Why not build SSO inside Better Auth

Better Auth is positioned as a lightweight, composable auth library. It excels at general scenarios such as email/password, OAuth social login, and session management. Enterprise SSO, by contrast, involves a different set of complexities: SAML assertion parsing, IdP metadata exchange, certificate rotation, multi-tenant configuration isolation, audit logs, and compatibility differences between each company's IdP implementation.

None of this is impossible to build, but the return on investment is low. Each new enterprise customer often means a new IdP integration debugging cycle. Handing this off to a specialized service like WorkOS trades self-built maintenance costs for external capabilities, while Better Auth still owns the core layer of user sessions.

SAML vs. OIDC: SAML 2.0 is an XML-based assertion protocol, and enterprise IdPs usually only support SAML, with cumbersome metadata exchange, signature verification, and certificate rotation processes; OIDC is a modern protocol based on JSON and OAuth 2.0, lighter weight but with slightly lower enterprise support. Having both means the app must handle two authentication flows, and services like WorkOS abstract them into a unified layer, reducing integration complexity.

The role of SCIM: SCIM (System for Cross-domain Identity Management) is a standard protocol for automating user and group provisioning. When an enterprise customer adds or removes employees or changes groups in their IdP, SCIM can sync those changes to the app in real time, avoiding manual account provisioning and permission residue. For mid-size and large enterprises, SCIM is a key component of identity lifecycle management.

Division of responsibilities: who handles login, who handles enterprise identity

The key to this approach is clear boundaries. Better Auth continues to handle registration, login, and session issuance and validation for regular users; WorkOS handles the enterprise-side SAML/OIDC authentication flow and SCIM directory sync. The two connect through a single identity conversion: after the user completes enterprise IdP authentication in WorkOS, the app receives the identity information and maps it to the Better Auth user system.

The advantage of this division is that it is incremental. Existing users are unaffected and still follow the original login path; only enterprise customers that need SSO enter the WorkOS flow. The session layer does not need to be rebuilt, and existing Better Auth-based auth middleware and permission checks can continue to be reused.

Key steps for implementation

Identity mapping and session handoff

The enterprise identity returned by WorkOS needs a stable mapping to user records in the app. A common approach is to use the email or WorkOS user ID as the linking key, look up or create the corresponding account on the Better Auth side, and then issue a local session. Think through the account merging strategy in advance: the same email may come from both social login and enterprise SSO, so conflict handling rules need to be explicit.

Multi-tenancy and organization modeling

Enterprise SSO is naturally a multi-tenant scenario. Each enterprise customer corresponds to a separate WorkOS Organization with its own IdP connection configured. The app side needs to pass the organization ID through to business logic for data isolation and access control. SCIM sync is responsible for syncing user and group changes from the enterprise directory, reducing the operational burden of manual account provisioning.

The WorkOS Organization model: In WorkOS, each enterprise customer corresponds to an Organization, under which multiple IdP connections (such as SAML or OIDC) can be configured, with independent directory sync management. The app side associates business data through the Organization ID to achieve tenant isolation. This model naturally supports scenarios with multiple IdPs per enterprise or department-level SSO, while simplifying multi-tenant configuration management.

Logout and lifecycle management

Enterprise scenarios have higher logout requirements: after a user logs out on the IdP side, the app session should also be invalidated. This requires handling WorkOS logout callbacks and coordinating cleanup of Better Auth sessions. Account deactivation when employees leave also depends on SCIM sync events; otherwise permission residue is easy to occur.

Single logout (SLO) and SCIM events: Both SAML and OIDC support single logout flows, but implementations differ. WorkOS provides logout callbacks, and the app must invalidate the local session after receiving the callback. SCIM triggers app-side updates through event notifications (such as user deactivation and group changes), ensuring permissions stay consistent with directory state. Together, these form a closed loop for the enterprise identity lifecycle, preventing departed employees from retaining access.

Who this combination is for

If your product targets small and mid-size teams, self-built social login or Better Auth's social login is enough. But when sales starts encountering questions like "can you integrate with our Okta/Azure AD?", having SSO and SCIM capabilities ready in advance will significantly reduce friction in closing deals. Keeping Better Auth for sessions and bringing in WorkOS for enterprise identity is a compromise but pragmatic architectural choice—neither rewriting the auth system nor getting blocked by enterprise requirements.

One caveat: introducing an external identity service means one more dependency and one more data flow path, so scenarios with high compliance and data residency requirements need separate evaluation. For most SaaS products, this trade is worthwhile.

One-line Summary

Better Auth handles regular login, WorkOS handles enterprise SSO and SCIM, enabling incremental integration.

Paragraph Summary

The article explores how to provide SAML/OIDC single sign-on and SCIM directory sync for enterprise customers through WorkOS while preserving the Better Auth authentication architecture. The core idea is separation of responsibilities: Better Auth continues to manage regular user login and sessions, WorkOS handles enterprise identity authentication and directory sync, and the two connect through identity mapping. Integration requires attention to account merging strategy, multi-tenant organization modeling, logout callbacks, and lifecycle management. This approach suits SaaS products facing enterprise SSO requirements, avoids rewriting the auth system, but requires evaluating the compliance impact of external dependencies.